Executive brief
lamp-cloud is a user management application that stores user profiles including personal information and avatars. Through API endpoints at PUT /anyone/baseInfo and PUT /anyone/avatar, an authenticated attacker can modify any other user's profile by supplying a target user ID in the request, without the server validating ownership. This allows attackers to deface profiles, change user information, and replace avatars of arbitrary users.
Technical details
The UserInfoController endpoints fail to validate that the authenticated user matches the target user ID in the request body before forwarding to DefUserService. The service layer locates the target row by data.getId() without comparing it to the caller's identity (ContextUtil.getUserId()), allowing broken object level authorization (BOLA). The updateBaseInfo() method permits modification of nickName, idCard, sex, nation, education, workDescribe, and logo fields; updateAvatar() deletes and replaces the victim's existing avatar attachment.
Affected products
- lamp-cloud lamp-cloud through 5.10.0
Timeline
- 2026-09-21: disclosed: CVE-2026-94534 published